EUVD-2025-17742Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
6DescriptionCVE.org
Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network.
AnalysisAI
Network-accessible denial-of-service vulnerability in Microsoft's Local Security Authority Server (lsasrv) caused by improper access control (CWE-284). An unauthenticated remote attacker can exploit this with low complexity to render the LSA service unavailable, affecting authentication and security policy enforcement on affected Windows systems. The CVSS 7.5 severity reflects the high availability impact; however, real-world risk depends on EPSS score, KEV candidacy status, and active exploitation data not provided in the source materials.
Technical ContextAI
The Local Security Authority Server (lsasrv) is a critical Windows system service responsible for user authentication, password changes, and security policy enforcement. It operates as a privileged system process and manages sensitive security tokens and credentials. CWE-284 (Improper Access Control) indicates the vulnerability stems from insufficient authorization checks—specifically, the service likely fails to properly validate incoming network requests, allowing an unauthenticated remote attacker to trigger resource exhaustion, infinite loops, or crash conditions via malformed or repeated requests. The service's network accessibility (AV:N) combined with lack of privilege requirements (PR:N) and no user interaction (UI:N) means any remote network actor can trigger this without authentication, making it a direct threat to Windows domain infrastructure and standalone systems.
RemediationAI
- Apply Microsoft security patches for CVE-2025-33056 immediately upon availability (check Microsoft Update, Windows Update, or WSUS). 2. Prioritize patching domain controllers and authentication servers first. 3. Interim mitigations (if patch unavailable): restrict network access to LSA-related ports/services via firewall rules; implement network segmentation to limit which systems can reach LSA services; disable remote access to LSA if operationally feasible. 4. Monitor system event logs (Windows Security event ID 4719, 4625, and service-related errors) for exploitation attempts or LSA service crashes. 5. Consult Microsoft Security Response Center (MSRC) advisories for version-specific guidance. Patch availability and KB article numbers should be verified at Microsoft's official security updates page.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same weakness CWE-284 – Improper Access Control
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today